CVE-2008-2302: Cross-Site Scripting (XSS) Vulnerability in Django
Summary
CVE-2008-2302: Django Cross-site scripting (XSS) vulnerability. Affects django across 3 version ranges.
>= 0.91, < 0.91.2
>= 0.95, < 0.95.3
>= 0.96, < 0.96.2
Fixed in 0.91.2, 0.95.3 or 0.96.2, depending on the release line you run. How to fix ↓
Also tracked for
- python-django · Debian:11
The same CVE-2008-2302 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Django is a popular Python web framework used for developing web applications. It provides a high-level, efficient, and secure way to handle web requests and responses. The vulnerability in question affects Django versions 0.91 to 0.91.2, 0.95 to 0.95.3, and 0.96 to 0.96.2. Django's administration application contains a login form that is susceptible to a cross-site scripting (XSS) attack. This vulnerability allows remote attackers to inject arbitrary web script or HTML through the URI of a specific previous request.
Vulnerability Detail
The XSS vulnerability in Django's administration login form enables attackers to inject malicious web script or HTML code. By exploiting this vulnerability, an attacker can execute arbitrary code within the context of the affected user's browser. This can lead to various security risks, including session hijacking, data theft, and unauthorized actions on behalf of the user. The vulnerability originates from inadequate input sanitization and validation in the login form's handling of the URI.
How To Fix
Latest published version: 6.1.2 as of 22 Oct 2026
pip install --upgrade "django==6.1.2"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 0.91, < 0.91.20.91.2pip install --upgrade "django==0.91.2" -
>= 0.95, < 0.95.30.95.3pip install --upgrade "django==0.95.3" -
>= 0.96, < 0.96.20.96.2pip install --upgrade "django==0.96.2"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, developers can implement additional input sanitization and validation measures specifically for the login form. This can involve using security libraries or frameworks that provide robust input filtering and encoding functions. However, applying the official fix by upgrading to a secure version of Django is the recommended approach.
Conclusion
The XSS vulnerability in Django's administration login form poses a significant security risk to web applications built on affected versions of Django. To mitigate this vulnerability, it is crucial to upgrade to Django version 1.1 or later. This upgrade will patch the vulnerability and ensure the application's security. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for django →
FAQ
The vulnerability allows attackers to inject malicious code into the login form, potentially leading to unauthorized access, data theft, and other security breaches.
You can use the Vulert Playground at Vulert Scanner to check if your application is vulnerable to this specific issue. The playground analyzes your Pipfile.lock and provides real-time alerts for open-source vulnerabilities.
No, only Django versions 0.91 to 0.91.2, 0.95 to 0.95.3, and 0.96 to 0.96.2 are vulnerable. It is recommended to upgrade to version 1.1 or later to mitigate the vulnerability.
While specific exploits for this vulnerability may exist, they have not been disclosed publicly. However, it is crucial to address the vulnerability promptly to prevent potential attacks.
While implementing additional input sanitization and validation measures can provide temporary mitigation, upgrading to a secure version of Django is the recommended long-term solution. Upgrades ensure that other potential vulnerabilities are also addressed.
References
Related vulnerabilities
Recent vulnerabilities recorded for django.
